From 1f8d23ec5bffe560f17518ef06837de5c1ed90cd Mon Sep 17 00:00:00 2001
From: yuneng-jiang <yuneng.jiang@gmail.com>
Date: Mon, 23 Feb 2026 18:16:38 -0800
Subject: [PATCH] fix: set cookie path and add error feedback on claim failure

---
 .../src/app/onboarding/OnboardingForm.tsx            | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/ui/litellm-dashboard/src/app/onboarding/OnboardingForm.tsx b/ui/litellm-dashboard/src/app/onboarding/OnboardingForm.tsx
index 3adb30c601..6b229be06c 100644
--- a/ui/litellm-dashboard/src/app/onboarding/OnboardingForm.tsx
+++ b/ui/litellm-dashboard/src/app/onboarding/OnboardingForm.tsx
@@ -14,6 +14,7 @@ export function OnboardingForm({ variant }: OnboardingFormProps) {
   const [form] = Form.useForm();
   const searchParams = useSearchParams()!;
   const inviteId = searchParams.get("invitation_id");
+  const [claimError, setClaimError] = React.useState<string | null>(null);
 
   const {
     data: credentialsData,
@@ -38,16 +39,21 @@ export function OnboardingForm({ variant }: OnboardingFormProps) {
   const handleSubmit = (formValues: { password: string }) => {
     if (!accessToken || !jwtToken || !userId || !inviteId) return;
 
+    setClaimError(null);
+
     claimToken(
       { accessToken, inviteId, userId, password: formValues.password },
       {
         onSuccess: () => {
-          document.cookie = "token=" + jwtToken;
+          document.cookie = `token=${jwtToken}; path=/; SameSite=Lax`;
           const proxyBaseUrl = getProxyBaseUrl();
           window.location.href = proxyBaseUrl
             ? `${proxyBaseUrl}/ui/?login=success`
             : "/ui/?login=success";
         },
+        onError: (error: Error) => {
+          setClaimError(error.message || "Failed to submit. Please try again.");
+        },
       }
     );
   };
@@ -128,6 +134,10 @@ export function OnboardingForm({ variant }: OnboardingFormProps) {
             <Input.Password />
           </Form.Item>
 
+          {claimError && (
+            <Alert type="error" message={claimError} showIcon className="mb-4" />
+          )}
+
           <div className="mt-10">
             <Button htmlType="submit" loading={isPending}>
               {variant === "reset_password" ? "Reset Password" : "Sign Up"}